Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I'm using twofish. Say you have a 120 bit key, is there any difference in using a 128 bit bit keylength or a 256 bit one?

Since the most significant digits of the key will be allo zero in both cases, does the keylen parameter really matter?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Well, it turns out that, both from a security and a performance standpoint, it doesn't really matter.

From a security standpoint, the goal (which, as far as we know, Twofish achieves) is that if you know all but N bits of the key, it still takes about $2^N$ trial decrypts to recover the remaining bits. So, it doesn't matter if you have a 128 bit Twofish key (and give the attacker 8), or if you have a 256 bit Twofish key (and give the attacker 136); he still needs to iterate through the remaining 120 bits.

From a performance standpoint, the only difference between 128 bit Twofish keys and 256 bit Twofish keys is during the key scheduling operation; after that, the encryption and decryption operations do not depend on the key size.

On the other hand, if you go through the Twofish specification, we find that they do specify how to use odd-sized keys; you append zero bytes up to the next "standard" size (which would be 128 bits in this case); this is section 4.3.1 of the book.

Given that there is a standard way to handle it, well, you might as well go with it.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.